Leaderboard
1125All-time rank
HC
Hegic(old contract)
Mar 1, 2025
$80K
Lost
$80K
Recovered
$0
Net loss
$80K
Unrecovered0% recovered
A deprecated Hegic WBTC Puts Pool contract (deployed January 4, 2022) was drained through its unprotected withdrawWithoutHedge() path, which did not decrement share balances. The attacker deposited liquidity, bought put options, withdrew the liquidity, then exercised the options.
- Target
- DeFi
- Classification
- Protocol Logic
- Technique
- Withdrawal Logic Flaw
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Mar 1, 2025Exploit executed — $80K drained via withdrawal logic flaw
- Attributed to Unknown
- Recovery status Unrecovered 0%